I don't know that much about the security model. But I think if you really want to verify device integrity you should use an attestation key. That is supposed t

I don't know that much about the security model. But I think if you really want to verify device integrity you should use an attestation key. That is supposed to be un-spoofable (although bugs can still occur in any software, which would defeat the integrity guarantees).